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Abstract. 


There are many papers on hydro installations, but very few describe any errors or 
omissions, simply because utilities do not want such incidents publicized. During 
a career of over 60 years, the author has accumulated details on over almost 50 
instances where structures or equipment have not performed as expected. Most 
incidents have been published in a series of “Lessons learned” columns in the 
magazine “Hydro Review”, where the incident was disguised by changing the 
numbers slightly. This paper describes four of the more spectacular incidents, a 
turbine-generator tied down to prevent rotation, with 20,000HP being dissipated 
through the runner and draft tube (Canada), two exploding turbines (Russia and 
Nigeria), and one burst new very large concrete casing (Canada). 
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1. Introduction. 


About 35 years ago, the author was asked to be part of 
a committee assembled by the Electric Power Research 
Institute (EPRI) of Palo Alto, California, to promote the 
interests of a new magazine “Hydro Review” dedicated to 
hydro in North America. The owner and publisher was an 
engineer named Carl Vansant, and over the following years 
the author came to know Carl quite well. We would meet 
every year at conferences, and discuss the latest hydro 
gossip. At one of the dinners, Carl mentioned that he had 
heard rumors of several “incidents”, but being an editor, 
could never obtain any concrete information, and asked me 
if I knew of any such occurrences. I replied that I had 
recently written a long paper describing 22 incidents, had 
submitted the paper to several magazines and journals, but 
it had always been rejected, with one editor even calling to 
mention that they would never publish anything negative to 
hydro. Carl asked for a copy, but then, no word for the next 
18 months, and I thought that again, that was the end of it. 

However Carl did phone; very excited with an idea. If 
each “incident” could be enlarged, the accident described in 
more detail, along with the measures used in the repair, and 
concluding with a “lesson learned” in a short article of 
about 1,000 to 1,500 words, he would publish the article in 
his magazine. Between April 1996 and April 2012, a total 
of 49 “Lessons Learned” columns were published, and I 
have received many phone calls from plant operators 
wanting to know a contact for the plant where the incident 
had occurred, since he wanted to discuss the details, only to 
be told — “Joe, that was your plant” — the incident was 
always disguised by changing numbers and location. 

The incidents have ranged from Kaplan turbines 
installed with the blades upside-down, to _ penstocks 
collapsing due to incorrect relief valve controls. It has been 
a very rewarding and informative experience. 

For this dissertation, I have selected four of the more 
spectacular and interesting “incidents”. 


2. The Brazeau intake - 1964. 


The Brazeau project is quite complex. It includes an 
embankment dam some 65m high across the Brazeau 
River, (140km SE of Edmonton) a powerplant containing 
two unique pump-turbines which pump water up into a 
long canal when the reservoir is low; and turbine water into 
the canal when the reservoir is high. Near the downsteam 
end of the 18km long canal there is a powerhouse with 2 
Francis turbines having a total capacity of 343MW. There 
were two low-level outlets through the dam temporarily 
used as a spillway, until the main spillway was built several 
years later between the pump-turbines and the dam. 

As consultants on the project, we were encouraged to 
“push the envelope” on the design, provided we advised the 
owner, Calgary Power of the risks. Unfortunately in one 
case, we pushed the design envelope a bit too far. 


The intake was founded on over-consolidated glacial 
till containing discontinuous sand lenses. Our geotechnical 
consultant was an eminent professor “Dr. Harvey”, who had 
undertaken many design assignments for Calgary Power 
and was deemed infallible. He had presented his design 
concept for the intake at a meeting in Montreal attended by 
the, president of Calgary Power and also of Montreal 
Engineering, the consulting company, along with several 
vice-presidents and chief engineers and me. Dr. Harvey and 
later sent us his report. However, when I saw the report and 
details of the design for the intake foundation, and water 
barrier, I was worried about the complexity to such an 
extent, that I wrote a 2-page memo to Walter, our Chief 
Civil Engineer and my supervisor, expressing my concerns. 
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Project layout. 





I could not put my finger on exactly what was 
troubling about the design, other than the fact that the drain 
below the intake to discharge any seepage, was very large at 
18inches diameter. But my instinct said something was 
definitely wrong. In my memo, which I still have, I 
discussed the risks in the design and ended by requesting 
another meeting with Dr. Harvey. My chief civil engineer 
said I could not question Dr. Harvey’s designs, so no 
meeting and he discarded my memo into the waste paper 
basket, but I told him I was keeping my copy. However, I 
was so worried that I requested the site resident engineer, 
Frank Vassallo, to carefully monitor the water pressure 
under the intake, a simple task, since there was a drainage 
gallery below the intake, accessible by a vertical 100ft 
ladder. I also provided Frank with a chart showing safe, 
unsafe and disaster uplift water pressures, with a note 
saying that I had to be advised of the measured pressure on 
a daily basis. 

As the work progressed, all went well. I had been 
inspecting the construction work about every three months, 
flying out to Edmonton, renting a car, and driving to the 
site. The daily pressure readings at the intake showed no 


change, and all seemed well. In November 1964, I went to 
site to commission the first unit, and was met at the airport 
by a very worried Frank. 





View of intake — headpond half full. Vertical inspection 
shaft is in square box in corner nearest to camera. 


He told me that over the past few hours, the water 
pressure under the intake had started to increase, was now 
over the safe level, and if it continued at the same rate, it 
would reach the disaster pressure in just 19 hours. The 
reservoir in front of the intake was only at half level, a 
precaution very fortunately proposed by Frank months 
previously, when he understood my concerns. 
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Schematic of intake. 


However, there was no way to evacuate the water 
except through the turbine, unfortunately not ready to 
operate, since the thrust bearing was still being installed, 
and this task would not be completed for another few days. 

During our discussions on the 90 minute drive back to 
the site we arrived at a plan to pass water through the 
turbine by tying down the generator, preventing the unit 
from rotating, something never done in the past. 

At site we had a meeting with the contractor, and the 
turbine erector Hans Jensen from Dominion Engineering, 
and phoned Dr. Harvey. We initiated the plan after Frank 
and I had signed letters taking over control of the project 
and absolving the contractor and the turbine manufacturer 
of any damages. The construction camp at the powerhouse 
was evacuated, and because of the danger, the only staff 


remaining on site was the contractor’s superintendent, 
Frank and one of his engineers, a volunteer from the survey 
crew to read the pressure gauges, Bill Maxwell, the plant 
chief operator, Hans and myself. 
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Section through Brazeau powerhouse. 
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Hans, was instructed to stop bearing installation and tie 
down the 157MW generator by attaching wire ropes from 
the generator spider to any fixed point in the powerhouse. 
Within two hours the generator was laced with rope and 
secure. You almost had to climb through the ropes to access 
the turbine pit, and I didn’t think the generator would rotate 
under any circumstances, since Hans had done such a good 
job. The wicket gates were opened to 6% and a close watch 
was kept on water level in the gallery and flow in the drain 
at a measuring station between the two penstocks about 
80m down the slope from the intake. After about three 
hours, it became evident that the battle was being lost, and 
that the wicket gates would have to be opened further. 

After some discussion, and over the vociferous 
objections of Hans, the wicket gates were opened to 11%. 
By this time the noise and vibration within the powerhouse 
was indescribable - expected, since something like 20,000 
horsepower of energy was being dissipated through the 
stationary turbine! The effect on the rate of water level rise 
in the gallery was immediate; it peaked within 0.3m of the 
gallery roof before subsiding. Within a few more hours the 
headpond was empty, and the crisis was over. 

What had gone wrong? A detailed examination of the 
headpond upstream of the intake revealed a watertight 
blanket. However, the rate of water inflow to the gallery 
indicated that there must have been a direct connection to 
horizontal sand lenses within the foundation till adjacent to 


the intake. Eventually, the investigation concentrated on the 
sheet steel piles beside the intake, where it was found that 
there was just enough flow area within the interlocks to 
conduct water down to the sand lenses, through and below 
the perimeter sheet steel piling and then up the drains into 
the gallery. Water could flow into the sheet steel pile 
interlocks through the vertical steel slots where the steel to 
steel contact was discontinuous. 

The remedial work included welding closed all the 
vertical interlock slots from 3m below grade to 1m above 
maximum water level, the addition of a bentonite- 


beneficiated blanket contact with the sheet steel piling to 
3m below grade to improve impermeability, and a float 
operated alarm in the drainage gallery. The repairs, 
undertaken in mid-winter, proved successful and operated 
without incident. 
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Hans Jensen and Bill Maxwell at powerhouse bridge. 


When I returned to Montreal, I walked into Walter’s 
office with my memo. He said to forget about it, and that 
was the last of the matter, but it certainly was my baptism 
of fire in the hydro business. 

A few years later I was asked to participate in a panel 
discussion on emergency actions during a dam failure. All 
the other panel members spoke about committees and 
action approvals, consultations with the head office and so 
forth. I asked the chairman if I could speak last, and when I 
spoke, I summarized the measures taken during the 
Brazeau failure, without identifying the project, noting the 
need for immediate actions, sufficient authority to 
command resources, the ability to take responsibility for 
the work and someone willing to step in front to direct 
work without having to refer back to any other offices. This 
was possible at Brazeau due to the close relationship 
between consultant and client. It is certainly not possible 
today with numerous agencies responsible for various 
safety issues, overlapping jurisdictions, and the inability to 
assume unquestioned command. This explains the failure of 
FEMA at New Orleans. Who would be foolish enough 
today to say to Hans, the turbine erector, “we just have to 
do it. I will type out a paper absolving Dominion 
Engineering of all responsibility, you can read it over the 





phone to Percy Soicher (his superior in Montreal) and we 
can both sign it”. 


3. Sayano-Shushenskaya turbine explosion. 


Hydro turbines do not explode, but there have been 
three such incidents worldwide in the past few years, and I 
have been associated with all three. One was at Grand 
Rapids in Manitoba, where I was part of a 2-man board, 
along with Don Coulson, assisting with the investigation. 
Don managed to find the cause — undersized non-standard 
bolt heads on the turbine headcover, along with fatigue 
failure due to improper assembly. The second incident, at 
Kainji in Nigeria will be described later. 

Sayano-Shushenskaya is a large 6,400MW Francis 
turbine equipped powerplant in Russia, where a turbine 
exploded at 8.13am on 17" August 2009, unfortunately 
with considerable loss of life. It is located in south-central 


Google image 
of Sayano- 
Shushenskaya. 


There are 
10 units with 
large 650MW 
turbines, all 
operating under 
a rated net head 
of 194m and at 
a speed of 
142.9rpm. as 
Runner diameter is 6.77m. Total weight of the runner, 
wicket gate assembly, headcover, shaft and generator rotor 
is over 1,500tons. Immediately after the explosion, a 
security camera managed to record the spectacular image of 
the 1,500 ton spinning turbine and generator suspended on 
an enormous column of water discharging from the turbine 
pit for Unit #2, about 10m above the generator floor! 





Security camera 
image of ejected 
turbine and 


generator. 
When the 
accident was 


reported, my first 
impression was a 
terrorist act, since 
the explosion 
was so catastrophic. However, I was asked to undertake a 
peer review of an article by Hamill (Ref. 1), from which 
most of this data has been obtained. The explosion was so 
severe that it completely destroyed Unit #2, and the 


adjacent units. The other units in the powerhouse were also 
damaged, except Unit #6 which was undergoing repairs. 
The initial cause of the accident was attributed to fatigue 
failure of the headcover bolts as at Grand Rapids. 


Generator floor after explosion. 





Section through 
dam and 
powerhouse 


However, the 
magnitude of the 
explosion does not 
support this 
analysis. Hamill 
has presented a 
strong case that 
the accident was 
due to draft tube 
water column 
separation, and 

consequent 
collapse of the 
vapor bubble 
exerting an excessive upward force on the turbine 
headcover, resulting in a catastrophic failure and ejection of 
the turbine generator from the turbine pit. 
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The Conan of Unit #2. 


The powerplant formed part of the Eastern Siberian grid 
where 70% of the load was from aluminum smelters. Power 
was provided by only two plants, Sayano Shushenskaya and 
the 4,500MW Bratskaya development. Due to the nature of 
the load, frequency control was very poor. Initially, the 
Bratskaya powerplant followed the changing load, and 
Sayano was on base load. However, in 2002, a program to 
improve frequency control was initiated with the objective 
of connecting with adjacent power grids, and resulted in the 
installation of a new automated joint load control along 
with new governors at Sayano. 

Unfortunately, there was a fire at Bratskaya on the day 
before the accident, and load following requirements were 
shifted to Sayano. Unit #2 was designated as the lead unit, 
and experienced large load swings prior to the accident. 

At 8.00am, prior to the accident, Unit #2 was operating 
at near full load, producing 605MW. By 8.13am, the load 
had been reduced to 475MW, and 25 seconds later, the load 
was Zero. 
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amaged powerhouse superstructure. 
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Section showing turbine-generator components. 


Using published data, Hamill has calculated the forces 
acting on the turbine runner and head cover just prior to the 
accident. There were — 

e Runner downthrust from hydraulic pressure = 7,500 T. 

e Weight down from components = 1,500 Tons. 

e Break resistance of headcover studs at ultimate tensile 
strength = 23,000 Tons. 

Total resisting download = 32,000 Tons. 

e Waterhammer load up = 2,550 Tons. 

e Draft tube vapor cavity collapse causing upthrust on 
headcover = 38,000 Tons. 

Total upward load = 40,550 Tons. 


Total upthrust from 
explosion = 40,550 tons. jk Weight of turbine, headcover, 
: | wie = shaft and generator rotor 


=, = 1,500 tons down. 


Head cover stud break 
load = 23,000 tons down. 
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Downthrust on runner 
from water = 7,500 tons. 


Upthrust f 
bubble in draft tube 


collapse = 38,000 tons. Total downthrust prior 


to explosion = 32,000 tons. 
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Load analysis for headcover. 





The load combination is subject some criticism, since 
such loads as waterhammer will not occur during the vapor 
cavity collapse. Nevertheless, no matter how the loads are 
added, the exploding force greatly exceeds the holding 
force, resulting in the catastrophic rupture. 

If the accident was due to collapse of the draft tube 
vapor cavity, the last analysis is to determine the governor 
closing time which could cause the vapor cavity to form. 
This was calculated at anything faster than 6 seconds, and 
this rate of closure could easily have been set on the 
governor servomotor in an attempt to improve frequency 
control — faster response = less frequency deviation. There 
are two other facts to support the analysis — 

e The headcover studs all show instantaneous rupture, 
with no bending, indicating straight upward thrust, 
confirmed by the security camera photo. 

e The wicked gates were all bent outwards, indicating a 
large internal explosion. 

No further data has been divulged by the plant 
operators, hence this analysis remains to be confirmed — but 
in the author’s opinion, it appears to be correct. 


4. La Forge #2 cracked concrete casing. 


The La Forge #2 powerplant is located in northern 
Quebec, about 400km west of the entrance to James Bay, 
and is the most northern powerhouse owned by Hydro 
Quebec. During September of 1995, the Canadian 


Electricity Association conducted a tour of the facility as it 
was nearing completion. I had a good look at the concrete 
semi-spiral casing, and I was impressed by the size, and had 
the same reaction when looking at the draft tube! Intake 
gates are 6.1m wide by 17.75m high. Each turbine produces 
155MW at a net head of 28.8m. Flow per unit is 600m’/s, 
and the runner diameter is 8.45m. 


Aerial view of 
completed 
powerhouse and 
spillway. 


However, there 
was an interesting 
“incident” during 
commissioning of 
the units. The 
“watering up” 
process was started wherein the water passages are slowly 
filled with water through by-pass valves. Due to the large 
size of the units, this process took many hours, so the 
commissioning staff decided to let the water flow into the 
units during the night, expecting to return the next day to 
continue the commissioning. 

Next day they were surprised to hear water running 
within the powerhouse, and a red light on in the control 
room indicating an overflow in the sump. They ran 
downstairs to the turbine floor and were astonished to see 


several centimeters of water covering the floor and flooded 
turbine pits. Closer inspection revealed spouts of water 
emanating from long cracks in the concrete near the end 
wall of Unit #2. The by-pass valves were immediately 
closed, and pumps installed to remove the water. But what 
had happened”? 


Section 
through 
powerhouse. 


A few days 
later I had a call 
from Dr. Albert 
Nessim, an old 
colleague from 

Montreal 
Engineering 
who asked me a 
simple question “what is the maximum stress in reinforcing 
steel where concrete will not crack under the tension?” and 
I replied that everyone knew the answer — about 83MPa 
(12,000psi.). Of course, I had to ask why he wanted to 
know. So he told me about the incident, and that he had 
photos of the spouting water. I immediately told him that I 
wanted to see them, since I knew the engineers who had 
designed the powerhouse, and could not imagine they could 
make such a mistake in the design. Albert had been 
engaged to back-engineer the design to determine the cause 
of the cracking. 

The massive concrete structure was so complex, that a 
finite element computer program had been used to calculate 
stresses. The concrete beam across the top of the semi- 
spiral casing was over 6m thick, so there was more than 
sufficient concrete to take the forces. Albert looked over 
the program, the modeling shape, and all seemed well. 

If the program data was correct, the only other source of 
error was in the boundary conditions. The computer had 
modeled the surrounding rock with strength parameters for 
sound granite rock, about 8 times stronger than concrete. 
The computer output indicated that the rigid rock would act 
as a vice containing the structure to prevent any movement, 
resulting in only minimum reinforcing steel being required 
in the 6m thick concrete slab above the semi-spiral casing. 
In fact, the rock had been severely cracked when blasting 
out the excavation for the powerhouse, and was no longer 
supporting the side walls. The result was cracking due to 
the water pressure within the casing pushing out the end 
wall and compressing the cracked rock. By assuming 
minimum support from the rock, Albert was able to 
duplicate the crack pattern. 

Nineteen post-tensioned anchors were required to stich 
the structure together and stop the leaks. 

This incident shows what can happen when there is a 
lack of “grey haired what-if’ engineers — someone who can 
ask all sorts of questions about the design assumptions. 
Fortunately, Hydro-Quebec has taken steps to remedy this. 
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Inside gigantic La Forge #2 turbine draft tube. 
5. Kainji (Nigeria) turbine runaway. 


4 empty bays 


Units 12 to 5 


Admin bldg. 





fm A 


Kainji development. 


In 1971, Montreal Engineering obtained a contract to 
add generation capacity to the Kainji development in 
central Nigeria. The powerhouse had 4 Kaplan units each 
generating 85MVA, and 8 empty bays for future units. It 
was being operated under the supervision of a team from 
Ontario Hydro, and provided most of the power for Lagos. 
Over the next 6 years, four more units were installed, 2- 
115MVA Kaplans, and 2-145MVA propeller units (3). It 
proved to be a most interesting assignment. In May of 1971, 
I flew to Lagos and on to the small airport at Kainji, 
accompanied by two colleagues. We spent most of our time 
obtaining data for the engineering work, and one morning, 
when I was in the control room copying some of the 
operating records, I noted several red lights on the control 
board. I walked over and saw that they indicated fires at 
three of the turbine governors. 

I asked the operator sitting at the control desk why he 
had not taken any action, and he replied that the red lights 
were always on. So I walked down to the governors to see 
what the problem was, and found that the cooling air duct 
above each governor had been blocked with rags, so the 
temperature sensor on the governor was above the upper 
limit, signaling a fire. I then traced the route of the cooling 
duct back to the upper floor, and found that another vent 
was in the glass-sided cubicle beside the generator, where 
the unit operator was stationed. The operator was lying on a 


mattress on the floor, fast asleep, with his head beside the 
vent! I found the same scene in the other three cubicles. I 
made a note to add some redundancy to the automatic 
controls for the new units. 
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George Cuthbertson, plant operator, Bob Provost and 
plant manager. Admin building in background. 


But we were not successful in designing an absolutely 
foolproof control system. 30 years later, in 2001, I saw a 
news item that a turbine unit had “blown up” at Kainji. As 
mentioned, water turbines just do not explode, so I was 
curious as to what had happened, and called some of the 
engineers who had worked on the project. Also, I happened 
to attend an international conference shortly after; and there 
was a paper on the incident by an engineer from the United 
States Bureau of Reclamation (5) who had offered to 
undertake a free inspection. As is common, the official 
published report did not fully describe the accident, and I 


managed to pull 
together a more 
Pit available for accurate 


future units #1 to #6. 


description of the 
em wax waa = event based on the 
na report and my 

> phone calls. 


Section through 
pit for units #1 to 
#6. 











Apparently, the plant operators had great difficulty 
keeping the equipment operating due to a lack of spare 
parts, exacerbated by non-convertibility of Nigerian 
currency and their inability to obtain import permits. Even 
governor oil was impossible to obtain, and it tended to 
“disappear” as the operators siphoned off small quantities to 
be sold in glass vials at the local market as a “personal” 
lubricant. The result was predictable, low oil in the 
governor caused an alarm in the control room, and further 
loss of oil would cause a unit to stop operating, hence all 
the safety controls, and there were many, were by-passed, 
allowing the unit to continue operating with no safeguards. 





Pit for future units, #5 
in bottom foreground. 


Eventually the 
inevitable happened, 
and the following is an 
edited extract from the 
Sadiki paper describing 
details of the event - 

On November ©&, 
2000, at 10.59GMT, 
generating Unit #5 lost 
governor oil pressure. 
An audible low 
pressure annunciation 
was heard in the 
powerhouse control 
room and the master 
relay immediately tripped. The unit rejected 109MW load, 
tripped a 330kV circuit breaker and immediately started to 
approach runaway speed. The redundant governor was out 
of service and there was no backup to close the turbine 
gates. 

At 11.02GMT the turbine was rotating at 50% 
overspeed. Attempts to control the unit from the Control 
room and the actuator proved futile. The emergency shut- 
off switch malfunctioned. (The head-gates were operated 
with a hydraulic cylinder hoist, and over the years the seals 
had worn causing the gate to drift down. The limit switch 
used to keep the gate open had also failed, and was not 
operational. To prevent the gates closing, they had been 
propped open with steel beams). 

At 11.03GMT, the unit began to vibrate violently off 
center with extremely loud banging noises caused by the 
rotor poles crashing against the stator windings, turbine 
blades hitting the draft tube throat ring and disassembling 
of the wicket gate linkages. The generator and turbine shaft 
began to thrust violently up and down in a I to 2 second 
frequency causing tremendous hydraulic pressures. At 
11.05GMT a loud explosive noise was heard and the 
turbine pit started to flood, the (outward opening) draft tube 
door failed, and the entire section of the draft tube steel 
lining was completely blown out. 


At 11.07GMT attempts were made to lower the intake 
gates. (When the alarm sounded, the chief operator tried to 
shut down the unit, could not, so he had to close the gates 
from the top of the dam. He could not take the lift to the 
dam deck since it had long ago ceased working, and there 
was no lighting in the stairs, all the light bulbs having been 
stolen leaving the dark stairway populated by bats and 
snakes. So he jumped into his car and drove around onto 
the dam crest, and about 15 minutes after the unit went to 
over-speed the head gate was almost fully closed, but 
damage to the turbine was severe). 

The unit intake gates were eventually lowered; but a 
complete seal was not achieved due to damaged seals. 
Approximately 15m°/s continued to flow under the gates. 
Eventually the gates were closed. Flood waters continued 
to flow (from the open draft tube) equalizing at tailwater 
elevation, shutting down the powerhouse for 3 weeks. 
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Section through Unit #5, illustrating damage. 


The unit has remained out of service until recently, and 
is now being repaired. 


6. Conclusions. 


It is only through the publication of such “incidents” 
that hydro engineers will learn from their mistakes. As 
mentioned, utilities and consultants, for obvious reasons, 
are very reluctant to divulge details of incidents. Perhaps, 
and at the risk of being thrown out of this room, we should 
encourage a “hydroleaks” website where engineers could 


post details of incidents, suitably disguised to hide the 
source and hydro development. 

Fortunately, the industry has recognized the need for 
passing on hydro design and construction experience 
through the use of “Review Boards” or “Panels of Experts” 
and now most major hydro developments have such staff on 
board, reviewing concepts, designs and the ongoing 
construction work. 
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